Establishing Control in an Uncertain AI Landscape: A Top 10 US Bank’s GenAI Risk & Control Framework
A leading US bank confronted the challenge of governing generative AI—balancing innovation with control in a landscape of uncertainty.
The Challenge
As generative AI accelerated across the enterprise, the Bank faced a strategic dilemma: How can we scale innovation without compromising control?
Traditional risk frameworks—built for deterministic software—were not designed to govern systems that:
- Produce non-repeatable outputs
- Learn from evolving data sources
- Operate across diverse business contexts with varied user intent
- Resist conventional testing, tracing, or forecasting methods
Without a tailored approach, the Bank risked:
- Overlooking latent AI failure modes
- Misclassifying or underestimating risk exposures
- Losing regulatory confidence in the maturity of its oversight
The Solution
Rational Exponent delivered a GenAI Risk & Control Framework, grounded in a new perspective: AI risk must be understood not only by outputs, but by the conditions under which it activates.
The framework introduced:
- Two-Tier Risk Classification — Category 2 risks are latent, arising from the foundational capability itself; Category 3 risks are realized, triggered by user intent, timing, and context.
- Risk-to-Control Mapping — Aligning controls to when and where risks are likely to manifest.
- Lifecycle-Based Guidance — Ensuring timely and proportional risk mitigation.
- Unified Framework — Bridging builders, business users, compliance, and risk functions.
The Outcome
The Bank gained:
- Clarity on what makes GenAI risky—and under what conditions
- Precision in applying the right controls at the right lifecycle point
- Confidence to scale AI responsibly without overregulation or blind spots
- Credibility with regulators through evidence-based oversight
Insight
AI risk is not static—it is dynamic, conditional, and emergent.
This framework equips the Bank to manage not just what AI is, but what it may become under real-world conditions. Governance shifted from reactive oversight to a strategic capability.